Per Splunk site, the Splunk for Citrix NetScaler app is a set of field extractions, reports, lookups and dashboards which provide visibility into the Citrix NetScaler AppFlow, Application Firewall and VPN data. This app is configured to work with version 9.x and up of the Citrix NetScaler.

Sylvain Chareyre (Citrix Sales Engineer in one of my favorite place to be – Paris!),  wrote a cool procedure in order to demostrate easily the Splunk for NetScaler reporting with AppFirewall and VPN Data, but should also be similar with AppFlow.   The document below explains how to install Splunk and a python script in order to generate data and reporting.

Splunk for NetScaler AppFW and VPN reporting deployment guide 

For Citrix internal folks, the following link can be used, this includes the phython script with the Splunk app as mentioned in the above deployment guide :

Citrix Internal Splunk Pack

For external folks, the app is available at actual Splunk site:

Splunk software

If you have trouble with any of the link above, feel free to add to Comments with your contact info and we can send you the Splunk Pack with a pretty snazzy python script to make this whole procedure simple.